Each package supports its latest minor release line. Fixes are not backported to older majors.
| Package | Supported |
|---|---|
@byteshiftid/adonisjs-audit-trail |
1.x (latest minor) |
@byteshiftid/adonisjs-notifications |
1.x (latest minor) |
@byteshiftid/adonisjs-tenant |
1.x (latest minor) |
The previous @rikology/* names are deprecated and receive no fixes; upgrade to the @byteshiftid names.
Report privately through GitHub: open a security advisory. Do not open a public issue, discussion or pull request for a vulnerability.
Include:
- the affected package and version
- a description of the issue and its impact
- steps or code to reproduce it
- any suggested remediation
- Acknowledgment within 72 hours.
- Investigation and scoping, usually within 7 days.
- Fix and release, coordinated with you. Critical fixes ship out of band.
- Disclosure through a GitHub security advisory after the fix is published, crediting you if you agree.
Reports should concern the packages in this repository, for example audit hash-chain or redaction bypasses, tenant isolation bypasses, notification data exposure across users or tenants, or privilege escalation through package commands. Weak application configuration outside the packages' documented guarantees is out of scope. Package-specific hardening guidance lives in each package's docs/ and SECURITY.md.